configure tls for REST

John Zakrzewski · John Zakrzewski · commit 8f408187f5e6 · 2025-02-05T14:24:02.000-05:00
Signed-off-by: John Zakrzewski &lt;Jozakrzewski@microsoft.com&gt;
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
@@ -48,8 +48,8 @@ dependencies:
     version: 4.1.2
     repository: https://openebs.github.io/dynamic-localpv-provisioner
     condition: localpv-provisioner.enabled
-  - name: cert-manager
-    version: v1.12.10
-    repository: https://charts.jetstack.io
-    alias: cert-manager
-    condition: cert-manager.enabled
+  # - name: cert-manager
+  #   version: v1.12.10
+  #   repository: https://charts.jetstack.io
+  #   alias: cert-manager
+  #   condition: cert-manager.enabled
diff --git a/chart/templates/mayastor/apis/api-rest-deployment.yaml b/chart/templates/mayastor/apis/api-rest-deployment.yaml
@@ -45,7 +45,6 @@ spec:
           image: "{{ .Values.image.registry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-api-rest:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
-            - "--dummy-certificates"
             - "--no-auth"
             - "--http=[::]:8081"
             - "--request-timeout={{ .Values.base.default_req_timeout }}"{{ if .Values.base.jaeger.enabled }}
@@ -56,6 +55,22 @@ spec:
             {{- if .Values.apis.rest.healthProbes.readiness.enabled }}
             - "--core-health-freq={{ .Values.apis.rest.healthProbes.readiness.agentCoreProbeFreq }}"
             {{- end }}
+          {{- if not .Values.base.tls.enabled }}
+            - "--dummy-certificates"
+          {{- else }}
+            - --cert-file=/etc/tls/tls.crt
+            - --key-file=/etc/tls/tls.key
+            # - --tls-client-ca-path=/etc/client_cert/ca.crt # CA cert for client verification with core-agent
+          volumeMounts:
+            - name: certs
+              mountPath: /etc/tls
+              readOnly: true
+            # - name: ca-cert
+            #   mountPath: /etc/client_cert/ca.crt
+            #   subPath: ca.crt
+            #   readOnly: true
+
+          {{- end }}
           ports:
             - containerPort: 8080
             - containerPort: 8081
@@ -86,3 +101,13 @@ spec:
             periodSeconds: {{ .Values.apis.rest.healthProbes.liveness.periodSeconds }}
             timeoutSeconds: {{ .Values.apis.rest.healthProbes.liveness.timeoutSeconds }}
           {{- end }}
+      {{- if .Values.base.tls.enabled }}
+      volumes:
+        - name: certs
+          secret:
+            secretName: api-rest-tls
+        # - name: ca-cert
+        #   secret:
+        #     defaultMode: 420
+        #     secretName: agent-core-server-cert
+      {{- end }}
diff --git a/chart/templates/mayastor/csi/csi-controller-deployment.yaml b/chart/templates/mayastor/csi/csi-controller-deployment.yaml
@@ -117,14 +117,21 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - "--csi-socket=/var/lib/csi/sockets/pluginproxy/csi.sock"
-            - "--rest-endpoint=http://{{ .Release.Name }}-api-rest:8081"{{ if .Values.base.jaeger.enabled }}
+            {{ if .Values.base.jaeger.enabled }}
             - "--jaeger={{ include "jaeger_url" . }}"{{ end }}
             {{- range $key, $val := .Values.csi.node.topology.segments }}
             - "--node-selector={{ $key }}={{ $val }}"
             {{- end }}
             - "--ansi-colors={{ .Values.base.logging.color }}"
             - "--fmt-style={{ include "logFormat" . }}"
             - "--create-volume-limit={{ .Values.csi.controller.maxCreateVolume }}"
+            {{- if .Values.base.tls.enabled }}
+            - "--rest-endpoint=https://{{ .Release.Name }}-api-rest:8080"
+            - "--tls-client-ca-path=/etc/client_cert/ca.crt" # CA cert for client verification with rest
+            {{- else }}
+            - "--rest-endpoint=http://{{ .Release.Name }}-api-rest:8081"
+            {{- end }}
+
           env:
             - name: RUST_LOG
               value: {{ .Values.csi.controller.logLevel }}
@@ -135,6 +142,18 @@ spec:
           volumeMounts:
             - name: socket-dir
               mountPath: /var/lib/csi/sockets/pluginproxy/
+            {{- if .Values.base.tls.enabled }}
+            - name: ca-cert
+              mountPath: /etc/client_cert/ca.crt
+              subPath: ca.crt
+              readOnly: true
+            {{- end }}
       volumes:
         - name: socket-dir
           emptyDir:
+        {{- if .Values.base.tls.enabled }}
+        - name: ca-cert
+          secret:
+            defaultMode: 420
+            secretName: api-rest-tls
+        {{- end }}
diff --git a/chart/templates/mayastor/operators/operator-diskpool-deployment.yaml b/chart/templates/mayastor/operators/operator-diskpool-deployment.yaml
@@ -46,7 +46,12 @@ spec:
           image: "{{ .Values.image.registry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-operator-diskpool:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
+            {{- if .Values.base.tls.enabled }}
+            - --tls-client-ca-path=/etc/client_cert/ca.crt # CA cert for client verification with rest
+            - "-e https://{{ .Release.Name }}-api-rest:8080"
+            {{- else }}
             - "-e http://{{ .Release.Name }}-api-rest:8081"
+            {{- end }}
             - "-n{{ .Release.Namespace }}"
             - "--request-timeout={{ .Values.base.default_req_timeout }}"
             - "--interval={{ .Values.base.cache_poll_period }}"{{ if .Values.base.jaeger.enabled }}
@@ -64,3 +69,23 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
+        {{- if .Values.base.tls.enabled }}
+          volumeMounts:
+            - name: ca-cert
+              mountPath: /etc/client_cert/ca.crt
+              subPath: ca.crt
+              readOnly: true
+            # - name: agent-ca-cert
+            #   mountPath: /etc/client_cert/agent-ca.crt
+            #   subPath: agent-ca.crt
+            #   readOnly: true
+      volumes:
+        - name: ca-cert
+          secret:
+            defaultMode: 420
+            secretName: api-rest-tls
+        # - name: agent-ca-cert
+        #   secret:
+        #     defaultMode: 420
+        #     secretName: agent-core-server-cert
+      {{- end}}
diff --git a/chart/values.yaml b/chart/values.yaml
@@ -90,6 +90,9 @@ base:
     containers:
       - name: etcd-probe
         command: ['sh', '-c', 'trap "exit 1" TERM; until nc -vzw 5 {{ .Release.Name }}-etcd {{.Values.etcd.service.port}}; do date; echo "Waiting for etcd..."; sleep 1; done;']
+  # tls_enabled to enable TLS for gRPC, REST communications
+  tls:
+    enabled: true
 
   metrics:
     # -- Enable the metrics exporter
@@ -841,80 +844,80 @@ localpv-provisioner:
   analytics:
     enabled: true
 
-cert-manager:
-  installCRDs: false
-  image:
-    # Controller image repository.
-    repository: quay.io/jetstack/cert-manager-controller
-    tag: 1.12.13
-  webhook:
-    image:
-      # Webhook image repository.
-      repository: quay.io/jetstack/cert-manager-webhook
-      tag: 1.12.13
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 100
-          preference:
-            matchExpressions:
-            - key: kubernetes.azure.com/mode
-              operator: In
-              values:
-              - system
-        - weight: 90
-          preference:
-            matchExpressions:
-            - key: openebs.io/engine=mayastor
-              operator: In
-              values:
-              - acstor
-        requiredDuringSchedulingIgnoredDuringExecution:
-          nodeSelectorTerms:
-          - matchExpressions:
-            - key: kubernetes.io/arch
-              operator: In
-              values:
-              - amd64
-            - key: kubernetes.io/os
-              operator: In
-              values:
-              - linux
-    tolerations:
-    - effect: NoSchedule
-      key: CriticalAddonsOnly
-      operator: Equal
-      value: "true"
-  affinity:
-    nodeAffinity:
-      preferredDuringSchedulingIgnoredDuringExecution:
-      - weight: 100
-        preference:
-          matchExpressions:
-          - key: kubernetes.azure.com/mode
-            operator: In
-            values:
-            - system
-      - weight: 90
-        preference:
-          matchExpressions:
-          - key: openebs.io/engine=mayastor
-            operator: In
-            values:
-            - acstor
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: kubernetes.io/arch
-            operator: In
-            values:
-            - amd64
-          - key: kubernetes.io/os
-            operator: In
-            values:
-            - linux
-  tolerations:
-  - effect: NoSchedule
-    key: CriticalAddonsOnly
-    operator: Equal
-    value: "true"
+# cert-manager:
+#   installCRDs: false
+#   image:
+#     # Controller image repository.
+#     repository: quay.io/jetstack/cert-manager-controller
+#     tag: 1.12.13
+#   webhook:
+#     image:
+#       # Webhook image repository.
+#       repository: quay.io/jetstack/cert-manager-webhook
+#       tag: 1.12.13
+#     affinity:
+#       nodeAffinity:
+#         preferredDuringSchedulingIgnoredDuringExecution:
+#         - weight: 100
+#           preference:
+#             matchExpressions:
+#             - key: kubernetes.azure.com/mode
+#               operator: In
+#               values:
+#               - system
+#         - weight: 90
+#           preference:
+#             matchExpressions:
+#             - key: openebs.io/engine=mayastor
+#               operator: In
+#               values:
+#               - acstor
+#         requiredDuringSchedulingIgnoredDuringExecution:
+#           nodeSelectorTerms:
+#           - matchExpressions:
+#             - key: kubernetes.io/arch
+#               operator: In
+#               values:
+#               - amd64
+#             - key: kubernetes.io/os
+#               operator: In
+#               values:
+#               - linux
+#     tolerations:
+#     - effect: NoSchedule
+#       key: CriticalAddonsOnly
+#       operator: Equal
+#       value: "true"
+#   affinity:
+#     nodeAffinity:
+#       preferredDuringSchedulingIgnoredDuringExecution:
+#       - weight: 100
+#         preference:
+#           matchExpressions:
+#           - key: kubernetes.azure.com/mode
+#             operator: In
+#             values:
+#             - system
+#       - weight: 90
+#         preference:
+#           matchExpressions:
+#           - key: openebs.io/engine=mayastor
+#             operator: In
+#             values:
+#             - acstor
+#       requiredDuringSchedulingIgnoredDuringExecution:
+#         nodeSelectorTerms:
+#         - matchExpressions:
+#           - key: kubernetes.io/arch
+#             operator: In
+#             values:
+#             - amd64
+#           - key: kubernetes.io/os
+#             operator: In
+#             values:
+#             - linux
+#   tolerations:
+#   - effect: NoSchedule
+#     key: CriticalAddonsOnly
+#     operator: Equal
+#     value: "true"
diff --git a/scripts/certs.sh b/scripts/certs.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -eou pipefail
+
+NAMESPACE="openebs"
+APP_NAME="api-rest"
+CERT_SECRET_NAME="api-rest-tls"
+CERT_DIR="$(dirname "$0")/certs"
+
+rm -rf certs/
+mkdir -p certs/
+
+# Create a self-signed root CA
+echo "Creating a self-signed root CA"
+openssl genrsa -out "${CERT_DIR}/ca.key" 4096
+openssl req -x509 -new -nodes -key "${CERT_DIR}/ca.key" -sha256 -days 3650 -out "${CERT_DIR}/ca.crt" -subj "/CN=api-rest-ca"
+
+# Create TLS certificate for the API REST
+echo "Creating a TLS certificate for the API REST"
+openssl genrsa -out "${CERT_DIR}/server.key" 4096
+openssl req -new -key "${CERT_DIR}/server.key" -out "${CERT_DIR}/server.csr" -subj "/CN=${APP_NAME}.${NAMESPACE}.svc.cluster.local"
+openssl x509 -req -in "${CERT_DIR}/server.csr" -CA "${CERT_DIR}/ca.crt" -CAkey "${CERT_DIR}/ca.key" -CAcreateserial -out "${CERT_DIR}/server.crt" -days 3650 -sha256
+
+# Convert the private key to PKCS#1 format if necessary
+echo "Verifying the RSA key format"
+if grep -q "BEGIN PRIVATE KEY" "${CERT_DIR}/server.key"; then
+  echo "Converting key to RSA format"
+  openssl rsa -in "${CERT_DIR}/server.key" -out "${CERT_DIR}/server-rsa.key"
+  mv "${CERT_DIR}/server-rsa.key" "${CERT_DIR}/server.key"
+else
+  echo "Key is already in RSA format"
+fi
+
+# Create a Kubernetes secret
+echo "Creating a Kubernetes secret"
+kubectl create secret generic ${CERT_SECRET_NAME} \
+  --from-file=tls.crt="${CERT_DIR}/server.crt" \
+  --from-file=tls.key="${CERT_DIR}/server.key" \
+  --from-file=ca.crt="${CERT_DIR}/ca.crt" \
+  -n ${NAMESPACE}
